azure-synapse-attach-user-mi

Attach a user-assigned MI to the workspace (workspaces/write + assign/action); all Spark jobs and pipelines then run as both the system-assigned MI and the newly attached user-assigned MI.

derived azure emits CanAttachIdentity

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`AnalyticsService`
source	`<principal>`
target	`<Synapse workspace>`
permissions	`Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` `Microsoft.Synapse/workspaces/write`
conditions	`role_compatibility` `service_state`

source type

Identity

target type

AnalyticsService

source

<principal>

target

<Synapse workspace>

permissions

Microsoft.ManagedIdentity/userAssignedIdentities/assign/action Microsoft.Synapse/workspaces/write

conditions

role_compatibility service_state

Narrative

{principal.name} can attach user-assigned MI {userMI.name} to Synapse workspace {target.name} (assign/action + workspaces/write); all subsequent Spark jobs and pipeline runs can mint tokens for {userMI.name}.

Raw rule rules/derived/azure/synapse.yaml

id: azure-synapse-attach-user-mi
emits: CanAttachIdentity
description: Attach a user-assigned MI to the workspace (workspaces/write + assign/action); all Spark
  jobs and pipelines then run as both the system-assigned MI and the newly attached user-assigned MI.
match:
- - principal: null
  - CanPassIdentity
  - userMI: null
where:
- ?principal has EFFECTIVE Microsoft.ManagedIdentity/userAssignedIdentities/assign/action on ?userMI
- ?principal has EFFECTIVE Microsoft.Synapse/workspaces/write on the workspace
emit:
  source_type: Identity
  target_type: AnalyticsService
  source: <principal>
  target: <Synapse workspace>
  permissions:
  - Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
  - Microsoft.Synapse/workspaces/write
  conditions:
  - role_compatibility
  - service_state
  false_positive_note: "BOTH permissions are required. assign/action alone does not modify the workspace;\
    \ workspaces/write alone does not grant rights on the MI. Honor the assign/action resource scope.\
    \ The new MI becomes an additional ExecutesAs target on the next job submission \u2014 existing running\
    \ sessions do not pick up the new identity immediately (CONDITIONAL(service_state) until the new session\
    \ starts)."
  narrative: '{principal.name} can attach user-assigned MI {userMI.name} to Synapse workspace {target.name}
    (assign/action + workspaces/write); all subsequent Spark jobs and pipeline runs can mint tokens for
    {userMI.name}.'